Anomaly identification method, apparatus, device, medium, and product

Abstract

The application discloses an abnormality identification method, device, equipment, medium and product. The method comprises the following steps: obtaining target object data of at least one first object; determining an interaction evaluation result corresponding to the at least one first object based on a change feature of the target object data over time; in the case that the interaction evaluation result indicates that the interaction between the at least one first object and a second object is abnormal, determining a reason for the interaction abnormality from at least one interaction operation dimension based on the target object data to obtain an abnormality identification result. The method can automatically identify the factors causing the interaction abnormality between the first object and the second object, reduces the abnormality analysis cost, enables the second object to dynamically optimize the interaction mode with the first object based on the obtained abnormality identification result, and improves the interaction maintenance effect between the first object and the second object.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to an anomaly identification method, apparatus, device, medium, and product. Background Technology

[0002] To ensure application stability, customer service is typically established through customer service contacts. For example, users can add customer service contact information to communicate and resolve issues.

[0003] The connection status between customer service representatives and users can, to some extent, maintain user activity within the application. Therefore, monitoring and analyzing the connection status and disconnection between customer service representatives and users can improve service quality. In related technologies, when user disconnection occurs, the customer service representative manually analyzes the reasons for the disconnection; however, this manual analysis process is costly. Summary of the Invention

[0004] This application provides an anomaly identification method, apparatus, device, medium, and product. The technical solution is as follows:

[0005] On the one hand, an anomaly identification method is provided, the method comprising:

[0006] Acquire target object data of at least one first object, wherein the first object is an object that interacts with a second object within a historical period, and the target object data is used to indicate the historical interaction operations between the first object and the second object within the historical period, wherein the object types of the first object and the second object are different.

[0007] Based on the time-varying characteristics of the target object data, an interaction evaluation result corresponding to the at least one first object is determined, and the interaction evaluation result is used to indicate the interaction maintenance status between the at least one first object and the second object.

[0008] If the interaction evaluation result indicates an abnormal interaction between the at least one first object and the second object, the cause of the interaction abnormality is determined from at least one interaction operation dimension based on the target object data to obtain an anomaly identification result, which is used to indicate the factors that caused the interaction abnormality.

[0009] On the other hand, an anomaly detection device is provided, the device comprising:

[0010] The acquisition module is used to acquire target object data of at least one first object, wherein the first object is an object that has interacted with a second object during a historical period, and the target object data is used to indicate the historical interaction operations between the first object and the second object during the historical period, wherein the object types of the first object and the second object are different.

[0011] The first identification module is used to determine the interaction evaluation result corresponding to the at least one first object based on the change characteristics of the target object data over time. The interaction evaluation result is used to indicate the interaction maintenance status between the at least one first object and the second object.

[0012] The second identification module is used to determine the cause of the interaction anomaly based on the target object data from at least one interaction operation dimension when the interaction evaluation result indicates an interaction anomaly between the at least one first object and the second object, and obtain an anomaly identification result, wherein the anomaly identification result is used to indicate the factors that caused the interaction anomaly.

[0013] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the anomaly identification method as described in any of the embodiments of this application above.

[0014] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the anomaly identification method as described in any of the embodiments of this application above.

[0015] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the anomaly identification methods described in the above embodiments.

[0016] The technical solution provided in this application includes at least the following beneficial effects:

[0017] Based on the changing characteristics of historical interaction operations between the first and second objects over time, it is determined whether there are interaction anomalies between the first and second objects. If interaction anomalies exist, the cause of the interaction anomaly is determined from at least one interaction operation dimension corresponding to the historical interaction operation, and the anomaly identification result is obtained to indicate the factors that cause the interaction anomalies. This enables the automatic identification of factors that cause interaction anomalies between the first and second objects based on the target object data formed by historical interaction operations, reducing the cost of anomaly analysis. It also allows the second object to dynamically optimize its interaction with the first object based on the obtained anomaly identification result, thereby improving the interaction maintenance effect between the first and second objects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application;

[0020] Figure 2 This is a flowchart of an anomaly identification method provided in an exemplary embodiment of this application;

[0021] Figure 3 This is a flowchart of an anomaly identification method provided in an exemplary embodiment of this application;

[0022] Figure 4 This is a schematic diagram illustrating the generation of interactive evaluation results provided in an exemplary embodiment of this application;

[0023] Figure 5 This is a flowchart of an anomaly identification method provided in an exemplary embodiment of this application;

[0024] Figure 6 This is a schematic diagram of the disconnection of the first object and the second object provided in an exemplary embodiment of this application;

[0025] Figure 7 This is a flowchart of a disconnection cause identification method provided in an exemplary embodiment of this application;

[0026] Figure 8 This is a structural block diagram of an anomaly recognition device provided in an exemplary embodiment of this application;

[0027] Figure 9 This is a structural block diagram of an anomaly recognition device provided in an exemplary embodiment of this application;

[0028] Figure 10 This is a schematic diagram of the structure of a server provided in an exemplary embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] In this application, the terms "first" and "second" are used to distinguish between identical or similar items that have essentially the same function. It should be understood that there is no logical or temporal dependency between "first" and "second", nor is there any limitation on the quantity or execution order.

[0031] The anomaly identification method provided in this application can be implemented by a terminal alone, by a server, or by the terminal and server through data interaction. This application does not limit this implementation. Optionally, the anomaly identification method implemented by the terminal and server through data interaction will be used as an example for explanation.

[0032] This is illustrative; please refer to it. Figure 1 This implementation environment involves a terminal and a server 110, which are connected via a communication network 120. Optionally, the communication network 120 can be a wired network or a wireless network, and this application embodiment does not limit this.

[0033] The terminal has an application installed and running that supports a virtual environment. This application can be any of the following: virtual reality application, 3D mapping application, third-person shooter (TPS) game, first-person shooter (FPS) game, multiplayer online battle arena (MOBA) game, or multiplayer shooting survival game.

[0034] The terminal device types include at least one of the following: game consoles, desktop computers, smartphones, tablets, e-book readers, Moving Picture Experts Group Audio Layer III (MP3) players, Moving Picture Experts Group Audio Layer IV (MP4) players, and laptop computers. The following examples illustrate this using a desktop computer as an example.

[0035] In this embodiment of the application, the terminal includes a first terminal 130 and a second terminal 140, wherein the first terminal 130 is a terminal controlled by a first object, and the second terminal 140 is a terminal controlled by a second object.

[0036] Those skilled in the art will understand that the number of the aforementioned devices can be more or less. For example, there may be only one device, or there may be dozens or hundreds of devices, or even more. This application does not limit the number or type of devices.

[0037] Server 110 includes at least one of a single server, multiple servers, a cloud computing platform, and a virtualization center. Server 110 is used to provide background services for anomaly identification. Optionally, server 110 undertakes the main computing work, and the terminal undertakes the secondary computing work; or, server 110 undertakes the secondary computing work, and the terminal undertakes the main computing work; or, server 110 and the terminal collaborate on computing using a distributed computing architecture.

[0038] It is worth noting that the aforementioned server 110 can be implemented as a physical server or as a cloud server in the cloud. In some embodiments, the aforementioned server 110 can also be implemented as a node in a blockchain system.

[0039] Schematic illustration: During the interaction between the first object and the second object, server 110 provides a data interaction intermediary for the first terminal 130 and the second terminal 140, and records the historical interaction operations between the first object and the second object, obtaining target object data 111 of the first object. When there is a need to identify anomalies in the interaction between the first object and the second object, server 110 reads at least one target object data 111 of the first object from the database. Based on the time-varying characteristics of the target object data 111, prediction model 112 determines the interaction evaluation result 113 corresponding to at least one first object. If the interaction evaluation result 113 indicates an interaction anomaly between at least one first object and the second object, attribution algorithm 114 determines the cause of the interaction anomaly from at least one interaction operation dimension based on the target object data 111, obtaining an anomaly identification result 115. This anomaly identification result 115 can indicate the factors causing the interaction anomaly between the first object and the second object. In some embodiments, server 110 sends the generated anomaly identification result 115 to the second terminal 140, so that the second object can adjust its interaction strategy with the first object according to the anomaly identification result 115.

[0040] Please refer to Figure 2 The diagram illustrates a flowchart of an anomaly identification method provided in an exemplary embodiment of this application. The execution entity for each step of this method can be a computer device; optionally, the computer device can be implemented as a terminal or a server. In this embodiment, the method is illustrated using an example of it being executed by a server. The method may include the following steps 210-230.

[0041] Step 210: Obtain target object data for at least one first object.

[0042] Optionally, an object refers to an object within the application platform. For example, an object may refer to a virtual account registered on the application platform; or, an object may refer to an object within the application platform that has permission to participate in the target activity.

[0043] In this embodiment, the application platform includes a first object and a second object, which are objects of different types. In one example, the first object indicates the object served by the application platform, and the second object indicates the object responsible for the operation and maintenance of related businesses within the application platform.

[0044] Optionally, the aforementioned application platform can be implemented as a game application platform, social application platform, video application platform, e-commerce application platform, etc., without limitation.

[0045] In some embodiments, an interactive relationship is established between the first object and the second object, wherein the interactive relationship indicates that the first object and the second object have the authority to actively interact with each other. Optionally, the interactive relationship between the first object and the second object may be an interactive relationship established within an application platform; or, the interactive relationship between the first object and the second object may be an interactive relationship established on a social platform associated with the application platform.

[0046] In some embodiments, the interaction relationship between the first object and the second object can be a one-to-one interaction relationship, for example, one second object serves one first object; or, the interaction relationship between the first object and the second object can be a many-to-one interaction relationship, for example, one second object serves multiple first objects.

[0047] Optionally, the interactions between the first and second objects through interactive relationships include conversations, likes, comments, and reposts, etc., which are not limited here.

[0048] The first object is an object that interacted with the second object within a historical time period. That is, after an interaction relationship is established between the first object and the second object, the first object can actively interact with the second object, or the second object can actively interact with the first object. In this embodiment, when there is an interaction between the first object and the second object, the interaction operation between the first object and the second object is recorded to obtain target object data. That is, the target object data is used to indicate the historical interaction operation between the first object and the second object within a historical time period.

[0049] Optionally, the target object data includes at least one of the following:

[0050] • The number of interactions between the first and second objects within a historical period, such as the number of conversations, likes, comments, and shares within a historical period;

[0051] • The number of interactions between the first and second objects in a single interaction process, such as the number of conversations in a single session or the number of replies in a single comment process;

[0052] • The interaction ratings of the first and second objects within a historical period, such as the frequency of conversations, likes, comments, and reposts within a historical period;

[0053] • The interaction duration between the first and second objects in a single interaction, for example, the session duration in a single conversation;

[0054] • The degree of completion of the interaction between the first object and the second object during the historical period, for example, the degree of completion of the second object's answer to the first object's question during the historical question-and-answer session between the first object and the second object;

[0055] • Interaction satisfaction of the first and second objects during the interaction process in the historical period, for example, the satisfaction of the first object with the conversation process in the historical conversation process between the first and second objects;

[0056] • The interaction response rate of the second object during the interaction process between the first object and the second object in a historical period. For example, the response rate of the second object to the conversation initiated by the first object during the historical session between the first object and the second object.

[0057] Step 220: Based on the characteristics of the target object data changing over time, determine the interaction evaluation result corresponding to at least one first object.

[0058] In this embodiment of the application, the interaction evaluation result is used to indicate the interaction maintenance status between at least one first object and a second object. Schematic, the interaction evaluation result determines whether there is an interaction anomaly between the first object and the second object by indicating the interaction maintenance status between the first object and the second object.

[0059] In some embodiments, a predictive model is used to determine the interaction evaluation result corresponding to at least one first object based on the time-varying characteristics of the target object data. The predictive model is capable of outputting predicted values ​​as interaction evaluation results for the time-series changes in the data.

[0060] Optionally, the above prediction model can be implemented as a pre-trained neural network model, such as a logistic regression model, convolutional neural networks (CNN), feedforward neural networks (FNN), residual networks (ResNet), transformers, etc.

[0061] Optionally, the above prediction model can be implemented as a machine learning model that is trained directly on the input data without pre-training, such as the Prophet model, the Autoregressive Integrated Moving Average (ARIMA) model, the Seasonal Autoregressive Integrated Moving Average (SARIMA) model, the Generalized Autoregressive Conditional Heteroskedasticity (GARCH) model, etc., without limitation here.

[0062] In some embodiments, before generating interactive evaluation results based on target object data, the target object data is preprocessed to obtain preprocessed target object data. Based on the time-varying characteristics of the preprocessed target object data, an interactive evaluation result corresponding to at least one first object is determined.

[0063] Optionally, the above data preprocessing includes at least one of data cleaning, feature engineering, etc.

[0064] Data cleaning is the process of removing or correcting errors, duplicates, and missing values ​​in data. Removing duplicates involves checking for and deleting duplicate records in the dataset. Correcting errors involves identifying and correcting errors or outliers in the data, such as correcting formatted errors or unreasonable data points (unreasonable maxima, minima, etc.). Missing values ​​are a common problem in datasets, and methods for handling them include deleting records containing missing values ​​(suitable for a small number of missing values), imputing missing values ​​(e.g., using the mean, median, mode, or interpolation methods), and using models to predict missing values ​​(e.g., K-nearest neighbors algorithm, regression models, etc.).

[0065] Feature engineering is the process of selecting, constructing, and transforming features of data. Optionally, feature engineering includes at least one of the following: feature preprocessing, feature extraction, feature selection, and feature construction. Feature preprocessing includes operations such as data normalization, data discretization, and data encoding.

[0066] Data normalization is used to indicate scaling data to a specified interval, such as [0,1] or [-1,1]. The purpose of data normalization is to speed up gradient descent and solve the problem quickly. In some embodiments, data normalization is achieved using Equation 1.

[0067] Formula 1: x ′ =(xX)min ) / (X max -X min )

[0068] Where x represents the original data, x ′ X represents the normalized data. min X represents the minimum value in the original data. max This represents the maximum value in the original data.

[0069] Data discretization refers to the process of dividing continuous numerical data into a finite number of intervals or categories, thereby converting continuous variables into discrete variables. The purpose of data discretization is to increase the nonlinearity of the model and improve its generalization ability. Optionally, data discretization methods include equal-interval discretization, equal-frequency discretization, cluster-based discretization, and information theory-based discretization. For example, when the target object data includes the age and grade features of the first object, the equal-interval discretization method can be used to discretize the data. That is, the features are grouped according to the principle that each grouping interval is the same. For example, taking the age feature as an example, for the range of age features, equal-interval discretization takes 10 as the interval interval, and the age is divided into (21~30), (31~40), (41~50)... and so on.

[0070] Data encoding refers to the process of converting data from one format or representation to another. The purpose of data encoding is to convert non-numerical data (such as categorical variables and text data) into numerical data so that it can be processed by machine learning algorithms. Optionally, data encoding methods include one-hot encoding, label encoding, target encoding, etc.

[0071] Feature extraction is the process of extracting useful information from raw data, typically used to reduce data dimensionality or transform data format. Optionally, feature extraction can be performed through Principal Component Analysis (PCA), Linear Discriminant Analysis (LDA), Autoencoder, Word Embeddings extraction, Term Frequency-Inverse Document Frequency (TF-IDF) vector extraction, etc.

[0072] In some embodiments, to improve the efficiency of feature extraction of the changing characteristics of target object data over time, the target object data is first serialized, that is, the target object data is serialized in chronological order to obtain a time series. Based on the changing characteristics of historical interaction operations over time in the time series, the interaction evaluation result is determined. In other words, the target object data is first preprocessed by serialization to obtain a time series, which allows the time series to clearly show the trend of data changes over time, thereby improving the efficiency of feature extraction of the changing characteristics of the data over time and enhancing data processing efficiency.

[0073] Optionally, the characteristics of historical interaction operations changing over time in a time series include at least one of the following: overall trend, periodic variation, short-term variation, and random variation. The overall trend refers to the general direction of development of the time series within a historical period, reflecting the long-term growth, decline, or stagnant state of the data. Periodic variation refers to the recurring regular changes in the time series within fixed time intervals within a historical period; this characteristic is usually related to seasonal factors or periodic events. Short-term variation refers to the rapid fluctuations of the time series within a short period (e.g., days or weeks) within a historical period; these fluctuations are usually influenced by short-term factors, such as holidays or special events. Random variation refers to unpredictable and irregular fluctuations in the time series; these fluctuations are usually caused by random factors.

[0074] Step 230: If the interaction evaluation result indicates an interaction anomaly between at least one first object and one second object, determine the cause of the interaction anomaly from at least one interaction operation dimension based on the target object data, and obtain the anomaly identification result.

[0075] Optionally, the interactive evaluation results can be used to indicate the time period evaluation value of at least one sub-time period within a historical time period; or, the interactive evaluation results can be used to indicate the future evaluation value of the future time period corresponding to the predicted historical time period.

[0076] Optionally, interaction anomalies include positive anomalies and negative anomalies. Positive anomalies include situations such as a sudden increase in interaction frequency, a sudden increase in the number of interactions, or a sudden increase in the number of interactions. Negative anomalies include situations such as an interruption in interaction, a sudden decrease in interaction frequency, a sudden decrease in the number of interactions, or a sudden decrease in the number of interactions.

[0077] In one example, when the interaction anomaly to be identified is a sudden change in interaction frequency (including sudden increases and decreases), the time period assessment or future assessment can include the magnitude of the interaction frequency change, where the magnitude of the interaction frequency change indicates the difference in interaction frequency between the identified time period and the interaction frequency of the adjacent previous time period. For example, the time period assessment of the (i+1)th sub-time period in a historical time period indicates the difference between the interaction frequency of the (i+1)th sub-time period and the interaction frequency of the ith sub-time period, where i is a positive integer; as another example, the future assessment of a future time period indicates the difference between the predicted interaction frequency of the future time period and the interaction frequency of the historical time period (or the last sub-time period within the historical time period).

[0078] In another example, when the interaction anomaly to be identified is a change in interaction interruption, the time period assessment value or future assessment value can include the magnitude of the interaction interruption change, where the magnitude of the interaction interruption change is used to indicate the magnitude of the change in the number of interaction interruptions in the identified time period. For example, the time period assessment value of the (i+1)th sub-time period in a historical time period is used to indicate the magnitude of the change (increase or decrease) between the number of interaction interruptions in the (i+1)th sub-time period and the number of interaction interruptions in the ith sub-time period, where i is a positive integer; as another example, the future assessment value of a future time period is used to indicate the magnitude of the change (increase or decrease) between the predicted number of interaction interruptions in the future time period and the number of interaction interruptions in the historical time period (or the last sub-time period within the historical time period).

[0079] In some embodiments, interruption anomalies are determined through threshold identification. Illustratively, when the interaction evaluation result reaches a preset difference threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining the anomaly identification result.

[0080] In one example, when the interaction evaluation result includes the magnitude of interaction frequency change, if the magnitude of the interaction frequency change indicated by the interaction evaluation result is greater than a preset magnitude threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining an anomaly identification result. For example, if the magnitude of the decrease in interaction frequency indicated by the interaction evaluation result is greater than the preset magnitude threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining an anomaly identification result, thereby determining the cause of the sudden decrease in interaction frequency; as another example, if the magnitude of the increase in interaction frequency indicated by the interaction evaluation result is greater than the preset magnitude threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining an anomaly identification result, thereby determining the cause of the sudden increase in interaction frequency.

[0081] In another example, when the interaction evaluation result includes the magnitude of interaction interruption changes, if the magnitude of the interaction interruption change indicated by the interaction evaluation result is greater than a preset magnitude threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining an anomaly identification result. For example, if the increase in interaction interruption indicated by the interaction evaluation result is greater than a preset magnitude threshold, the cause of the interaction anomaly is determined based on the target object data from at least one interaction operation dimension, thus obtaining an anomaly identification result and identifying the cause of the sudden increase in interaction interruptions.

[0082] In this application embodiment, the anomaly identification result is used to indicate the factors that cause the interaction anomaly. In some embodiments, the target object data includes data in at least two interaction operation dimensions. Optionally, the above-mentioned at least two interaction operation dimensions include at least two of the following: interaction frequency dimension, i.e., the number of interactions between the first object and the second object in a historical period; single interaction quantity dimension, i.e., the number of interactions between the first object and the second object in a single interaction process; interaction duration dimension, i.e., the interaction rating of the first object and the second object in a historical period; the interaction duration of the first object and the second object in a single interaction process; interaction completion dimension, i.e., the interaction completion degree of the first object and the second object in the interaction process in a historical period; the interaction satisfaction of the first object and the second object in the interaction process in a historical period; and interaction response rate dimension, i.e., the interaction response rate of the second object in the interaction process of the first object and the second object in a historical period.

[0083] In some embodiments, an attribution algorithm is invoked to determine the cause of the interaction anomaly from at least one interaction dimension based on the target object data, thereby obtaining the anomaly identification result. Optionally, the attribution algorithm mentioned above includes the Adtributor algorithm, the Problem Identification for Emerging Issues (iDice algorithm), Pearson product-moment correlation coefficient detection, the Isolation Forest algorithm, the Support Vector Data Description (SVDD) algorithm, etc., and is not specifically limited here.

[0084] In other embodiments, target object data is input into a pre-trained anomaly detection model, which determines the cause of the interaction anomaly from at least one interactive operation dimension, thereby obtaining the anomaly detection result. Optionally, the above-mentioned anomaly detection model can be implemented by neural network models such as convolutional neural networks, feedforward neural networks, residual networks, and transformers, without specific limitations.

[0085] The training process of the pre-trained anomaly detection model is as follows: acquiring sample interaction data and sample annotation information, wherein the sample interaction data is used to indicate the historical interaction operations between the first sample object and the second sample object, and the sample annotation information includes whether there is an anomaly in the interaction between the first sample object and the second sample object indicated by the sample interaction data, and the corresponding reason for the anomaly when there is an interaction anomaly; inputting the sample interaction data into the anomaly detection model to be trained to obtain the predicted detection result; determining the first loss value between the predicted detection result and the sample annotation information through the first loss function; iteratively adjusting the model parameters of the anomaly detection model to be trained according to the first loss value until convergence, thereby obtaining the anomaly detection model.

[0086] Optionally, the first loss function mentioned above can be implemented as at least one of the following: cross-entropy loss function, mean squared error loss (MSE) function, log loss function, least absolute deviations loss (L1 loss) function, etc., without limitation.

[0087] In summary, based on the changing characteristics of historical interaction operations between the first and second objects over time, it is determined whether there are interaction anomalies between the first and second objects. If interaction anomalies exist, the cause of the interaction anomaly is determined from at least one interaction operation dimension corresponding to the historical interaction operation, and anomaly identification results are obtained to indicate the factors that cause the interaction anomalies. This enables the automatic identification of factors causing interaction anomalies between the first and second objects based on the target object data formed by historical interaction operations, reducing the cost of anomaly analysis. It also allows the second object to dynamically optimize its interaction with the first object based on the obtained anomaly identification results, thereby improving the interaction maintenance effect between the first and second objects.

[0088] In some optional embodiments, the characteristics of historical interaction operations changing over time in the time series include at least one of the following: overall trend, periodic change characteristics, short-term change characteristics, and random change characteristics. Please refer to... Figure 3 The diagram illustrates a flowchart of an anomaly identification method provided in an exemplary embodiment of this application, which includes steps 221 to 2224.

[0089] Step 221: Serialize the target object data in chronological order to obtain a time series.

[0090] Optionally, the target object data includes at least one of the following: the number of interactions between the first object and the second object during a historical period; the number of interactions between the first object and the second object in a single interaction process; the interaction rating of the first object and the second object during a historical period; the interaction duration of the first object and the second object in a single interaction process; the interaction completion rate of the first object and the second object during a historical period; the interaction satisfaction of the first object and the second object during a historical period; and the interaction response rate of the second object during a historical period.

[0091] This illustrates how target object data can be arranged chronologically or according to the order of occurrence or time periods, and then serialized to obtain a time series. In one example, when the target object data includes the number of interactions between the first and second objects in a single interaction process, the corresponding number of interactions is sorted according to the chronological order of the interaction processes to obtain a time series.

[0092] In some embodiments, the target object data is preprocessed to obtain preprocessed target object data, and the preprocessed target object data is serialized in chronological order to obtain a time series. Optionally, the above data preprocessing includes at least one of data cleaning, feature engineering, etc. Data cleaning includes removing duplicate values, correcting erroneous data, and repairing missing values; feature engineering includes feature preprocessing, feature extraction, feature selection, and feature construction.

[0093] In some embodiments, when performing anomaly identification, in addition to using the target object data, object information data corresponding to at least one first object is also used.

[0094] Optionally, the object information data includes at least one of the following: basic information of the first object, platform interaction information, and object activity information.

[0095] The basic information indicates the basic attributes of the first object, such as the object's age, gender, registration period, operating system, and mobile terminal brand. The platform interaction information indicates the first object's interactive operations within the application platform during the historical period. The application platform refers to the platform to which both the first and second objects belong. For example, the content of the first object's statements on the application platform during the historical period, whether there were any negative emotions or comments, etc. The object activity information is the frequency change of the first object's login to the application platform during the historical period. For example, the frequency of the first object's login to the application platform during the historical period, and the frequency of the first object's participation in activities on the application platform, etc.

[0096] In a schematic manner, object information data corresponding to at least one first object is obtained, the object information data and target object data are integrated in chronological order, and the integrated result is serialized to obtain a time series.

[0097] Step 2221: Identify the overall changes in the time series within historical periods and obtain the trend term as the interactive evaluation result.

[0098] The trend term is used to indicate the interaction trend between at least one first object and a second object, representing a non-periodic change in the time series.

[0099] Optionally, the interactive change trend represented by the overall change situation includes linear trends and / or logical growth trends. Linear trends are applicable to business scenarios where data grows or decreases linearly over time, while logical growth trends are applicable to business scenarios where data growth has an upper limit.

[0100] In one example, taking the interactive change trend as a logical growth trend, the process can be achieved by predicting the trend term using a logistic regression model. The prediction formula for the trend term g(t) is shown in Formula 2.

[0101]

[0102] Where C indicates the upper limit capacity, representing the upper bound that g(t) can reach (e.g., C = 12.7), k represents the growth rate, the larger k is, the faster the trend will be (e.g., k = 1.67), m represents the turning point where the slope of the trend term changes, when t = m, the slope growth rate reaches its maximum (e.g., m = 0.1), and t represents the time index in the time series, used to describe the time dimension of the time series.

[0103] By combining the overall trend of change corresponding to the time series to generate interaction evaluation results, the obtained interaction evaluation results can characterize the long-term dynamic characteristics of the interaction maintenance between the first object and the second object, thereby revealing the intrinsic influence of the historical interaction operations between the first object and the second object on the maintenance of their interaction relationship, and improving the accuracy of the generated interaction evaluation results.

[0104] Step 2222: Identify the repetitive changes of the time series between preset periods in the historical time period, and obtain the periodic item as the interactive evaluation result.

[0105] The periodic term is used to indicate the periodic variation characteristics of the interaction between at least one first object and a second object within a preset period, that is, to characterize the periodic changes in a time series.

[0106] Optionally, the duration of the aforementioned preset period can be preset by the system, indicated by the second object, or obtained by dividing the time span according to the historical time period.

[0107] Optionally, the aforementioned preset period can be implemented as a period in years, quarters, months, days, hours, etc. In some embodiments, the period item can also be called a seasonal item.

[0108] In some embodiments, the periodic change is approximated by using a Fourier series, and the prediction formula for the periodic term s(t) is shown in Formula 3.

[0109]

[0110] Where P represents the period (e.g., 365 when the preset period is in years, and 7 when the preset period is in weeks), N represents the number of approximation terms used (e.g., N = 1246679), which is N in the Fourier expansion, a n b n These are the parameters to be learned.

[0111] By combining the periodic variation characteristics corresponding to the time series to generate interaction evaluation results, the obtained interaction evaluation results can characterize the periodic changes in the interaction maintenance of the first and second objects, thereby revealing the intrinsic influence of the historical interaction operations between the first and second objects on the maintenance of their interaction relationship and improving the accuracy of the generated interaction evaluation results.

[0112] Step 2223: Identify the changes in the time series during the preset event period in the historical time period, and obtain the event items as the interactive evaluation results.

[0113] Among them, the event item is used to indicate the short-term change characteristics of the interaction between at least one first object and a second object under the influence of a preset event, that is, to represent the impact of preset events with non-fixed periods in the time series on the predicted value.

[0114] Optionally, the aforementioned preset events can be implemented as holidays, event events (e.g., the anniversary of the application platform), etc.

[0115] In one example, taking the preset event implementation as a holiday as an example, suppose there are L different holidays (e.g., L = 4), D i This represents the set of past and future holidays. Then, one-hot encoding is performed on these holidays to obtain Z(t) as shown in Formula 4. Multiplying this by L gives the event item h(t).

[0116] Formula 4: h(t)=L*Z(t)=L*[1(t∈D1),…,1(t∈D L )]

[0117] By combining the short-term change characteristics of time series under the influence of some preset events to generate interaction evaluation results, the generated interaction evaluation results can focus on the short-term fluctuations of the interaction maintenance between the first and second objects under the influence of preset events, better identify noise and outliers in the data, and thus improve the robustness of anomaly identification.

[0118] Step 2224: Identify the fluctuations in the time series within historical periods and obtain the error term as the interactive evaluation result.

[0119] The error term is used to indicate the random variation characteristics of the interaction between at least one first object and a second object.

[0120] In some embodiments, the error term ∈ t It follows a normal distribution, that is, ∈ t =N(0,σ 2 ), where σ 2 For the error term ∈ t The variance of the prediction model is such that when the interactive evaluation result is the output result obtained by the prediction model, the prediction model optimizes the model parameters by minimizing the error term, thereby improving the anomaly identification accuracy of the prediction model.

[0121] In some embodiments, when performing anomaly detection, in addition to considering the aforementioned change characteristics, weight data can also be introduced to optimize the output of the prediction model. Illustratively, based on the changing characteristics of historical interaction operations over time in a time series, intermediate predicted values ​​are obtained, wherein the intermediate predicted values ​​include time period evaluation values ​​corresponding to at least two sub-time periods within the historical time period, and the time period evaluation values ​​are used to assess the maintenance of interaction between at least one first object and a second object within the sub-time period; weight data is obtained, which indicates the weight of the time period evaluation values ​​corresponding to at least two sub-time periods; the time period evaluation values ​​of at least two sub-time periods are weighted and summed based on the weight data to obtain the interaction evaluation result.

[0122] In some embodiments, the aforementioned weight data can be obtained based on the application platform's lifecycle data and object satisfaction data. The platform lifecycle data indicates the application platform's lifecycle stage within a sub-period, and the object satisfaction data indicates the user satisfaction of the first object with the second object within that sub-period. Illustratively, the platform lifecycle data and object satisfaction data corresponding to at least two sub-periods of the application platform to which the first object belongs are obtained; based on the platform lifecycle data and object satisfaction data, the weights corresponding to at least two sub-periods are determined to obtain the weight data.

[0123] As an illustration, the interaction evaluation results, which incorporate lifecycle data and object satisfaction data, are shown in Formula 5.

[0124]

[0125] Where y(t) is the intermediate predicted value, ynew t For interactive evaluation results, w1*x t This represents the stage of the application platform's lifecycle after weighting, with a value ranging from (0, 10). A larger value indicates a healthier application platform and higher user satisfaction. w2*x t This represents the weighted user approval rating, with a value range of (0,1). The larger the value, the higher the satisfaction of the first user with the second user. e is a natural constant.

[0126] By introducing lifecycle data and object satisfaction data to weight the intermediate predicted values ​​output by the prediction model, the anomaly detection effect of the prediction model can be optimized, the results of anomaly detection can be dynamically adjusted, and the accuracy of anomaly detection prediction can be improved, which has high practical application value.

[0127] In some embodiments, the prediction model is implemented as the Prophet model, which is a time series forecasting tool particularly suitable for processing time series data with seasonality, trend changes, and holiday effects. The Prophet model decomposes the time series into a trend term, a period term, an event term, and an error term based on an additive model.

[0128] In a schematic way, the time series is input into the Prophet model. The Prophet model decomposes the changing characteristics of the time series to obtain the trend term, periodic term, event term, and error term. In one example, the first three terms are mainly considered to determine the interactive evaluation result y(t), as shown in Formula 6.

[0129] Formula 6: y(t) = g(t) + s(t) + h(t)

[0130] Where g(t) represents the trend term, s(t) represents the period term, and h(t) represents the event term.

[0131] like Figure 4 As shown, it illustrates the generation of interactive evaluation result 403 provided by an exemplary embodiment of this application. The acquired target object data 401 is serialized to obtain a time series 402. The time series 402 is input into the Prophet model 410. The Prophet model 410 decomposes and predicts the time series 402 from three parts: trend item 411, period item 412, and event item 413, and outputs the interactive evaluation result 403.

[0132] In some embodiments, when the interaction evaluation result y(t) reaches a preset threshold, it indicates that there is an interaction anomaly between the first object and the second object.

[0133] In summary, based on the changing characteristics of historical interaction operations between the first and second objects over time, it is determined whether there are interaction anomalies between the first and second objects. If interaction anomalies exist, the cause of the interaction anomaly is determined from at least one interaction operation dimension corresponding to the historical interaction operation, and anomaly identification results are obtained to indicate the factors that cause the interaction anomalies. This enables the automatic identification of factors causing interaction anomalies between the first and second objects based on the target object data formed by historical interaction operations, reducing the cost of anomaly analysis. It also allows the second object to dynamically optimize its interaction with the first object based on the obtained anomaly identification results, thereby improving the interaction maintenance effect between the first and second objects.

[0134] In some optional embodiments, the target object data includes data from at least two interaction operation dimensions, and the interaction evaluation results include time period evaluation values ​​corresponding to at least two sub-time periods within the historical time period. Attribution analysis is performed on each interaction operation dimension to obtain anomaly identification results. For illustrative examples, please refer to [reference needed]. Figure 5 The diagram illustrates a flowchart of an anomaly identification method provided in an exemplary embodiment of this application, which includes steps 231 to 233.

[0135] Step 231: If the interaction evaluation result indicates an abnormal interaction between at least one first object and the second object, at least one abnormal sub-period is determined from at least two sub-periods based on the interaction evaluation result.

[0136] In some embodiments, the interaction evaluation result is used to indicate the magnitude of the predicted change in the interaction interruption between at least one first object and one second object within a historical period. If the magnitude of the change indicated by the interaction evaluation result reaches a preset magnitude threshold, it is determined that there is an interaction anomaly between the first object and the second object. The cause of the interaction anomaly is determined from at least one interaction operation dimension based on the target object data, and an anomaly identification result is obtained.

[0137] Indicatively, the interactive evaluation results include time period evaluation values ​​corresponding to at least two sub-time periods within the historical period, wherein the time period evaluation values ​​are data predicted by combining the change characteristics of the target object data.

[0138] In one example, the time period evaluation value is used to indicate the magnitude of the change in the interruption of interaction between the first and second objects within a sub-time period. Illustratively, sub-time periods in which the magnitude of change indicated by the time period evaluation value reaches a preset magnitude threshold in at least two sub-time periods are identified as abnormal sub-time periods. Optionally, the preset magnitude threshold used to determine the sub-time period and the preset magnitude threshold used to determine whether there are interaction anomalies in historical time periods can be the same threshold or different thresholds; this is not limited here.

[0139] Step 232: Determine the attribution analysis data corresponding to at least two interactive operation dimensions based on the time period evaluation value corresponding to at least one abnormal sub-time period.

[0140] Among them, the attribution analysis data is used to indicate the score of the interaction operation dimension under the preset analysis indicators. This score can be used to determine whether the interaction operation dimension is the cause of the interaction abnormality.

[0141] In some embodiments, an attribution algorithm is invoked to determine the cause of the interaction anomaly from at least one interaction dimension based on the time period evaluation value corresponding to at least one abnormal sub-time period, thereby obtaining an anomaly identification result. Optionally, the attribution algorithm mentioned above includes the Adtributor algorithm, iDice algorithm, Pearson coefficient detection, isolated forest algorithm, support vector data description algorithm, etc., and is not specifically limited here.

[0142] In some embodiments, the attribution algorithm is implemented as the Adtributor algorithm, which is a multidimensional time series anomaly root cause analysis algorithm, mainly used to quickly locate the root cause of anomalies.

[0143] Schematic, when the time period evaluation value is used to indicate the magnitude of the predicted change in the interaction interruption between at least one first object and one second object within the corresponding sub-time period, an abnormal true value corresponding to at least one abnormal sub-time period is obtained, which is used to indicate the actual magnitude of the interaction interruption between at least one first object and one second object within the abnormal sub-time period; based on the time period evaluation value corresponding to at least one abnormal sub-time period, dimension evaluation values ​​corresponding to at least two interaction operation dimensions are determined, which are used to indicate the magnitude of the predicted change in the interaction interruption between at least one first object and one second object within the interaction operation dimension within the abnormal sub-time period; based on the difference between the dimension evaluation value and the abnormal true value, a first attribution value corresponding to at least one abnormal sub-time period is determined; based on the proportion of the dimension evaluation value in the time period evaluation value, a second attribution value corresponding to at least one abnormal sub-time period is determined; the first attribution value and the second attribution value are used as attribution analysis data.

[0144] The first attribution value is used to indicate the difference between the true value and the predicted value in the interaction dimension (i.e., the surprise (S) value), and its calculation logic is shown in Formula 7.

[0145]

[0146] in, F represents the predicted value, and A represents the actual value.

[0147] The second attribution value is used to indicate the ratio of data fluctuations in the interactive dimension to the overall fluctuations (i.e., the explanatory power (EP) value), and its calculation logic is shown in Formula 8.

[0148] Formula 8: EP ij =(A ij (m)-F ij ) / (A(m)-F(m))

[0149] Among them, A ij (m)-F ij A(m)-F(m) indicates the difference between the actual and predicted values ​​in the interaction dimension, while A(m)-F(m) indicates the overall difference between the actual and predicted values. A higher EP value indicates a higher probability that this interaction dimension is the root cause of the interaction interruption.

[0150] Step 233: Determine the attribution dimension from the at least two interaction operation dimensions based on the attribution analysis data corresponding to the at least two interaction operation dimensions, and use it as the anomaly identification result.

[0151] In some embodiments, when the attribution analysis data includes a first attribution value (S value) and a second attribution value (EP value), the interaction dimension in at least one interaction dimension whose first attribution value is greater than a first threshold and whose second attribution threshold is less than or equal to a second threshold is determined as the attribution dimension, and an anomaly identification result is obtained.

[0152] Optionally, the first threshold and the second threshold may be preset thresholds by the system; or they may be thresholds set according to the duration of the historical period, wherein the first threshold is negatively correlated with the duration of the historical period, and the second threshold is positively correlated with the duration of the historical period.

[0153] In summary, based on the changing characteristics of historical interaction operations between the first and second objects over time, it is determined whether there are interaction anomalies between the first and second objects. If interaction anomalies exist, the cause of the interaction anomaly is determined from at least one interaction operation dimension corresponding to the historical interaction operation, and anomaly identification results are obtained to indicate the factors that cause the interaction anomalies. This enables the automatic identification of factors causing interaction anomalies between the first and second objects based on the target object data formed by historical interaction operations, reducing the cost of anomaly analysis. It also allows the second object to dynamically optimize its interaction with the first object based on the obtained anomaly identification results, thereby improving the interaction maintenance effect between the first and second objects.

[0154] In this embodiment, an attribution algorithm is used to perform root cause analysis on target object data encompassing multiple interactive operation dimensions. This quickly identifies problematic interactive operation dimensions, yielding the anomaly identification result, reducing the time and workload required for manual investigation, lowering anomaly identification costs, and improving anomaly identification efficiency. Specifically, when the attribution algorithm is implemented as an Adtributor algorithm, its output can be directly used for decision support, reducing the data processing volume in downstream anomaly identification result applications and improving overall business processing efficiency.

[0155] Optionally, the anomaly identification method provided in this application embodiment can be applied to anomalies in the interaction between the first object and the second object, including positive anomalies and negative anomalies. Positive anomalies include situations such as a sudden increase in interaction frequency, a sudden increase in the number of interactions, and a sudden increase in the number of interactions. Negative anomalies include situations such as an interruption in interaction, a sudden decrease in interaction frequency, a sudden decrease in the number of interactions, and a sudden decrease in the number of interactions.

[0156] In one example, we illustrate a scenario where a first object refers to a player in a game application, and a second object refers to a service personnel responsible for the operation and maintenance of the game application. The first and second objects establish a connection through a social application, and an abnormal interaction between the first and second objects results in the first object deleting the second object, leading to a disconnection.

[0157] like Figure 6The diagram illustrates a disconnection scenario between a first object 601 and a second object 602 provided in an exemplary embodiment of this application. After establishing a connection in a social application, the first object 601 can consult the second object 602 about game application-related activities. The second object 602 is responsible for answering the first object 601's questions, thereby maintaining the activity level of the first object 601 in the game application. In some cases, the first object 601 deletes the second object 602 for various reasons, resulting in a disconnection between the second object 602 and the first object 601. This affects the player maintenance needs of service personnel and may lead to player churn and other problems.

[0158] Indicatively, in response to the above situation, this application provides a method for identifying the cause of disconnection between a first object and a second object. Please refer to... Figure 7 The diagram illustrates a flowchart of a disconnection cause identification method provided in an exemplary embodiment of this application, which includes steps 701 to 705.

[0159] Step 701: Obtain at least one target object data and object information data of the first object.

[0160] In this embodiment of the application, the first object is a player object in the game application, for example, a player account registered in the game application.

[0161] In this embodiment, the game application also includes a second object, which is a service personnel responsible for the operation and maintenance of related businesses within the game application. In one example, the first object and the second object establish a connection through a social application.

[0162] In some embodiments, the at least one first object can be implemented as all objects that have a connection with the second object during the historical period; or, the at least one first object can be implemented as objects that have lost connection with the second object during the historical period.

[0163] Optionally, the target object data in this application embodiment includes at least one of the following: the number of conversations between the first object and the second object within a historical time period; the number of dialogues between the first object and the second object in a single conversation; the conversation frequency of the first object and the second object within a historical time period; the conversation duration of the first object and the second object in a single conversation; the completion rate of the second object's answer to the first object's questions during historical question-and-answer conversations between the first object and the second object; the satisfaction rate of the first object with the conversation process during historical conversations between the first object and the second object; and the response rate of the second object to conversations initiated by the first object during historical conversations between the first object and the second object.

[0164] The object information data includes the object's basic information (e.g., age, gender, registration period, operating system, mobile terminal brand, etc.), game login activity during historical periods, in-game chat messages, and whether there are negative emotions and comments.

[0165] Step 702: Integrate object information data and target object data in chronological order, and serialize the integration result to obtain a time series.

[0166] In some embodiments, before generating the time series, the object information data and the target object data are preprocessed to obtain preprocessed data. The preprocessed data is then integrated in chronological order, and the integrated result is serialized to obtain the time series.

[0167] Optionally, the above data preprocessing includes at least one of data cleaning and feature engineering. Data cleaning includes removing duplicate values, correcting erroneous data, and repairing missing values; feature engineering includes feature preprocessing, feature extraction, feature selection, and feature construction.

[0168] In some embodiments, when integrating object information data and target object data in chronological order, the object information data and target object data are integrated by a preset data splicing order to obtain an integration result.

[0169] Step 703: Input the time series data into the prediction model to obtain the disconnection prediction result between at least one first object and the second object.

[0170] In this embodiment, anomaly detection for time series data is achieved through a prediction model. Illustratively, the prediction model uses the time series' changing characteristics over time to determine the disconnection prediction result for at least one first object. The prediction model outputs a predicted value as the disconnection prediction result based on the changing characteristics of the data over time.

[0171] Optionally, the above prediction model can be implemented as a pre-trained neural network model, such as a logistic regression model, a convolutional neural network, a feedforward neural network, a residual network, a converter, etc.

[0172] Optionally, the above prediction model can be implemented as a machine learning model that is trained directly on the input data without pre-training, such as the Prophet model, the autoregressive integral moving average model, the seasonal autoregressive integral moving average model, the generalized autoregressive conditional heteroscedasticity model, etc., without limitation here.

[0173] In one example, taking the Prophet model as the prediction model, the time series is input into the Prophet model. The Prophet model decomposes the changing characteristics of the time series to obtain a trend term, a period term, and an event term. Combining the trend term, period term, and event term yields the disconnection prediction result. Specifically, the trend term indicates the disconnection trend between at least one first object and one second object, representing a non-periodic change in the time series; the period term indicates the periodic change characteristics of the disconnection between at least one first object and one second object within a preset period, i.e., it characterizes the periodic change in the time series; and the event term indicates the short-term change characteristics of the disconnection between at least one first object and one second object under the influence of a preset event.

[0174] In some embodiments, when implementing anomaly detection using the Prophet model, in addition to considering the aforementioned change characteristics, weight data can be introduced to optimize the output of the Prophet model. Illustratively, based on the changing characteristics of historical interaction operations over time in a time series, intermediate predicted values ​​are obtained, wherein the intermediate predicted values ​​include time period evaluation values ​​corresponding to at least two sub-time periods within the historical time period, and the time period evaluation values ​​are used to assess the disconnection between at least one first object and a second object within the sub-time period; weight data is obtained, which indicates the weight of the time period evaluation values ​​corresponding to at least two sub-time periods; the time period evaluation values ​​of at least two sub-time periods are weighted and summed based on the weight data to obtain the interaction evaluation result.

[0175] In some embodiments, the aforementioned weight data can be obtained based on the game application's lifecycle data and object satisfaction data. The game application's lifecycle data indicates the lifecycle stage of the game application within a sub-period, and the object satisfaction data indicates the user satisfaction of the first object with the second object within that sub-period. Illustratively, the lifecycle data and object satisfaction data of the game application to which the first object belongs are obtained for at least two sub-periods; based on the lifecycle data and object satisfaction data, the weights corresponding to at least two sub-periods are determined to obtain the weight data. In one example, the weighting of the intermediate predicted values ​​by this weight data is shown in Formula 5, and will not be elaborated upon here.

[0176] Step 704: If the disconnection prediction result indicates that there is an abnormality in the magnitude of the disconnection change between at least one first object and the second object, the cause of the disconnection is analyzed from at least one interaction operation dimension using an attribution algorithm based on object information data and target object data to obtain the disconnection identification result.

[0177] In some embodiments, when the disconnection prediction result indicates that the disconnection change magnitude between at least one first object and the second object reaches a preset magnitude threshold, the disconnection cause is analyzed from at least one interactive operation dimension using an attribution algorithm based on object information data and target object data to obtain the disconnection identification result.

[0178] Optionally, the attribution algorithms mentioned above include the Adtributor algorithm, iDice algorithm, Pearson coefficient detection, Isolation Forest algorithm, Support Vector Data Description algorithm, etc., and no specific limitation is made here.

[0179] In one example, taking the Attribution Algorithm implemented as the Adtributor algorithm, the target object data includes data from at least two interaction operation dimensions. The disconnection prediction results include time period prediction values ​​corresponding to at least two sub-time periods within the historical time period. When the time period prediction value is used to indicate the magnitude of the predicted disconnection between at least one first object and one second object within the corresponding sub-time period, an abnormal true value corresponding to at least one abnormal sub-time period is obtained. This abnormal true value is used to indicate the actual magnitude of the disconnection between at least one first object and one second object within the abnormal sub-time period. Based on the time period prediction value corresponding to at least one abnormal sub-time period, dimension prediction values ​​corresponding to at least two interaction operation dimensions are determined. These dimension prediction values ​​are used to indicate the magnitude of the predicted interaction interruption between at least one first object and one second object within the interaction operation dimension within the abnormal sub-time period. Based on the difference between the dimension prediction value and the abnormal true value, a first attribution value corresponding to at least one abnormal sub-time period is determined. Based on the proportion of the dimension prediction value in the time period prediction value, a second attribution value corresponding to at least one abnormal sub-time period is determined. The first and second attribution values ​​are used as attribution analysis data.

[0180] Indicatively, when the attribution analysis data includes a first attribution value (S value) and a second attribution value (EP value), the interaction dimension in at least one interaction dimension whose first attribution value is greater than a first threshold and whose second attribution threshold is less than or equal to a second threshold is determined as the attribution dimension, and the disconnection identification result is obtained.

[0181] Step 705: Provide the disconnection identification result to the second object.

[0182] In some embodiments, a disconnection identification result is sent to the client that the second object logs in, enabling the second object to adjust its interaction strategy with the first object based on the disconnection identification result.

[0183] In other embodiments, the disconnection identification result and the preset prompt are input into a pre-trained large language model. The large language model generates a connection maintenance suggestion based on the disconnection identification result. This connection maintenance suggestion is used to provide a second object with a prompt suggestion to maintain the connection with the first object. The connection maintenance suggestion is then sent to the client logged in by the second object.

[0184] In summary, this method determines whether an anomaly exists between the first and second objects based on the changing characteristics of their historical interaction operations over time. If such anomalies exist, the cause is identified from at least one interaction operation dimension corresponding to the historical interaction operations, yielding an anomaly identification result. This indicates the factors causing the anomaly, thereby automatically identifying the factors leading to the anomaly based on the target object data generated by historical interaction operations. This reduces analysis costs and allows the second object to dynamically optimize its interaction with the first object based on the obtained anomaly identification result, improving the interaction maintenance effect between the two objects.

[0185] It should be noted that this application may display prompt interfaces, pop-ups, or output voice prompts before and during the collection of user data. These prompt interfaces, pop-ups, or voice prompts are used to inform the user that their relevant data (such as target object data, object information data, etc.) is being collected. This ensures that the application only begins the steps for collecting user data after receiving confirmation from the user regarding the prompt interface or pop-up; otherwise (i.e., without receiving confirmation from the user), the steps for collecting user data end, meaning no user data is collected. In other words, all user data collected in this application is collected with the user's consent and authorization, and the collection, use, and processing of relevant user data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0186] Please refer to Figure 8 The diagram illustrates a structural block diagram of an anomaly detection device provided in an exemplary embodiment of this application. The device includes the following modules:

[0187] The acquisition module 810 is used to acquire target object data of at least one first object, wherein the first object is an object that has interacted with a second object during a historical period, and the target object data is used to indicate the historical interaction operations between the first object and the second object during the historical period, wherein the object types of the first object and the second object are different.

[0188] The first identification module 820 is used to determine the interaction evaluation result corresponding to the at least one first object based on the change characteristics of the target object data over time. The interaction evaluation result is used to indicate the interaction maintenance status between the at least one first object and the second object.

[0189] The second identification module 830 is used to determine the cause of the interaction anomaly based on the target object data from at least one interaction operation dimension when the interaction evaluation result indicates an interaction anomaly between the at least one first object and the second object, and obtain an anomaly identification result, wherein the anomaly identification result is used to indicate the factors that caused the interaction anomaly.

[0190] In some alternative embodiments, such as Figure 9 As shown, the first identification module 820 further includes:

[0191] The serialization unit 821 is used to serialize the target object data in chronological order to obtain a time series.

[0192] The identification unit 822 is used to determine the interaction evaluation result based on the changing characteristics of the historical interaction operations in the time series over time.

[0193] In some optional embodiments, the identification unit 822 is further configured to identify the overall changes of the time series within the historical period and obtain a trend item as the interaction evaluation result, wherein the trend item is used to indicate the interaction change trend between the at least one first object and the second object;

[0194] The identification unit 822 is further configured to identify the repetitive changes of the time series between each preset period in the historical time period, and obtain a periodic item as the interaction evaluation result. The periodic item is used to indicate the periodic change characteristics of the interaction between the at least one first object and the second object between the preset periods.

[0195] The identification unit 822 is further configured to identify the changes in the time series during a preset event within the historical period, and obtain event items as the interaction evaluation results. The event items are used to indicate the short-term change characteristics of the interaction between the at least one first object and the second object under the influence of the preset event.

[0196] The identification unit 822 is further configured to identify fluctuations in the time series during the historical period and obtain an error term as the interaction evaluation result. The error term is used to indicate the random variation characteristics of the interaction between the at least one first object and the second object.

[0197] In some optional embodiments, the identification unit 822 is further configured to obtain intermediate prediction values ​​based on the time-varying characteristics of the historical interaction operations in the time series. The intermediate prediction values ​​include time period evaluation values ​​corresponding to at least two sub-time periods in the historical time period. The time period evaluation values ​​are used to evaluate the maintenance of the interaction between at least one first object and the second object in the sub-time period.

[0198] The first identification module 820 further includes:

[0199] The acquisition unit 823 is used to acquire weight data, the weight data being used to indicate the weights of the time period evaluation values ​​corresponding to the at least two sub-time periods respectively;

[0200] The identification unit 822 is further configured to perform a weighted summation of the time period evaluation values ​​of the at least two sub-time periods based on the weight data to obtain the interaction evaluation result.

[0201] In some optional embodiments, the acquisition unit 823 is further configured to acquire platform lifecycle data and object satisfaction data corresponding to the application platform to which the first object belongs in the at least two sub-time periods, respectively. The platform lifecycle data is used to indicate the lifecycle stage of the application platform to which the sub-time period belongs, and the object satisfaction data is used to indicate the user satisfaction of the first object with the second object in the sub-time period.

[0202] The acquisition unit 823 is further configured to determine the weights corresponding to the at least two sub-time periods based on the platform lifecycle data and the object satisfaction data, thereby obtaining the weight data.

[0203] In some optional embodiments, the acquisition unit 823 is further configured to acquire object information data corresponding to the at least one first object, wherein the object information data includes at least one of the following: basic information of the first object, platform interaction information, and object activity information. The basic information is used to indicate the basic attributes of the first object, the platform interaction information is used to indicate the interactive operations of the first object in the application platform during the historical period, the application platform is the platform to which the first object and the second object belong, and the object activity information is the frequency change of the first object logging into the application platform during the historical period.

[0204] The serialization unit 821 is further configured to integrate the object information data and the target object data in the time sequence, and serialize the integration result to obtain the time sequence.

[0205] In some optional embodiments, the interaction evaluation results are used to indicate the magnitude of the predicted change in the interruption of interaction between the at least one first object and the second object within the historical period.

[0206] The second identification module 830 is further configured to determine the cause of the interaction anomaly from the at least one interaction operation dimension based on the target object data when the change magnitude indicated by the interaction evaluation result reaches a preset magnitude threshold, and obtain the anomaly identification result.

[0207] In some optional embodiments, the target object data includes data from at least two interactive operation dimensions, and the interaction evaluation result includes time period evaluation values ​​corresponding to at least two sub-time periods within the historical time period.

[0208] The second identification module 830 further includes:

[0209] The filtering unit 831 is configured to determine at least one abnormal sub-period based on the interaction evaluation result when the interaction evaluation result indicates an abnormal interaction between the at least one first object and the second object;

[0210] Attribution unit 832 is used to determine the attribution analysis data corresponding to the at least two interactive operation dimensions based on the time period evaluation value corresponding to the at least one abnormal sub-time period. The attribution analysis data is used to indicate the score of the interactive operation dimension under a preset analysis index.

[0211] The attribution unit 832 is further configured to determine the attribution dimension from the at least two interactive operation dimensions based on the attribution analysis data corresponding to the at least two interactive operation dimensions, as the anomaly identification result.

[0212] In some optional embodiments, the time period evaluation value is used to indicate the magnitude of the predicted change in the interruption of interaction between the at least one first object and the second object within the corresponding sub-time period;

[0213] The second identification module 830 further includes:

[0214] The acquisition unit 833 is used to acquire the abnormal real value corresponding to the at least one abnormal sub-period, and the abnormal real value is used to indicate the actual change range of the interaction interruption between the at least one first object and the second object within the abnormal sub-period.

[0215] The attribution unit 832 is further configured to determine the dimension evaluation values ​​corresponding to the at least two interaction operation dimensions based on the time period evaluation value corresponding to the at least one abnormal sub-time period. The dimension evaluation value is used to indicate the magnitude of the change in the interaction interruption between the at least one first object and the second object under the interaction operation dimension predicted during the abnormal sub-time period.

[0216] The attribution unit 832 is further configured to determine the first attribution value corresponding to each of the at least one abnormal sub-period based on the difference between the dimension evaluation value and the abnormal true value.

[0217] The attribution unit 832 is further configured to determine the second attribution value corresponding to each of the at least one abnormal sub-period based on the proportion of the dimension evaluation value in the time period evaluation value;

[0218] The attribution unit 832 is further configured to use the first attribution value and the second attribution value as the attribution analysis data.

[0219] In some optional embodiments, the attribution unit 832 is further configured to determine the interaction dimension in the at least one interaction dimension where the first attribution value is greater than a first threshold and the second attribution threshold is less than or equal to a second threshold as the attribution dimension, thereby obtaining the anomaly identification result.

[0220] It should be noted that the anomaly identification device provided in the above embodiments is only an example of the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the anomaly identification device and the anomaly identification method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0221] Figure 10 This illustration shows a schematic diagram of the structure of a server provided in an exemplary embodiment of this application. Specifically, it includes the following structure.

[0222] Server 1000 includes a Central Processing Unit (CPU) 1001, a system memory 1004 including Random Access Memory (RAM) 1002 and Read Only Memory (ROM) 1003, and a system bus 1005 connecting the system memory 1004 and the CPU 1001. Server 1000 also includes a mass storage device 1006 for storing the operating system 1013, application programs 1014, and other program modules 1015.

[0223] Mass storage device 1006 is connected to central processing unit 1001 via a mass storage controller (not shown) connected to system bus 1005. Mass storage device 1006 and its associated computer-readable media provide non-volatile storage for server 1000. That is, mass storage device 1006 may include computer-readable media (not shown) such as hard disk or compact disc read-only memory (CD-ROM) drive.

[0224] Without loss of generality, computer-readable media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that computer storage media are not limited to the above-mentioned types. The system memory 1004 and mass storage device 1006 described above can be collectively referred to as memory.

[0225] According to various embodiments of this application, server 1000 can also be connected to a remote computer on a network, such as the Internet. That is, server 1000 can be connected to network 1012 via network interface unit 1011 connected to system bus 1005, or it can use network interface unit 1011 to connect to other types of networks or remote computer systems (not shown).

[0226] The aforementioned memory also includes one or more programs, which are stored in the memory and configured to be executed by the CPU.

[0227] Embodiments of this application also provide a computer device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The processor loads and executes the at least one instruction, at least one program, code set, or instruction set to implement the liveness detection method provided in the above-described method embodiments. Optionally, the computer device may be a terminal or a server.

[0228] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the liveness detection method provided in the above-described method embodiments.

[0229] Embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the liveness detection methods described in the above embodiments.

[0230] Optionally, the computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. The random access memory may include resistive random access memory (ReRAM) and dynamic random access memory (DRAM). The sequence numbers of the embodiments in this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0231] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0232] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An anomaly identification method, characterized in that, The method includes: Acquire target object data of at least one first object, wherein the first object is an object that interacts with a second object within a historical period, and the target object data is used to indicate the historical interaction operations between the first object and the second object within the historical period, wherein the object types of the first object and the second object are different. Based on the time-varying characteristics of the target object data, an interaction evaluation result corresponding to the at least one first object is determined, and the interaction evaluation result is used to indicate the interaction maintenance status between the at least one first object and the second object. If the interaction evaluation result indicates an abnormal interaction between the at least one first object and the second object, the cause of the interaction abnormality is determined from at least one interaction operation dimension based on the target object data to obtain an anomaly identification result, which is used to indicate the factors that caused the interaction abnormality.

2. The method according to claim 1, characterized in that, The step of determining the interaction evaluation result corresponding to at least one first object based on the data change characteristics of the target object data over time includes: The target object data is serialized in chronological order to obtain a time series; The interaction evaluation result is determined based on the characteristics of the changes in the historical interaction operations over time in the time series.

3. The method according to claim 2, characterized in that, The prediction of the interaction evaluation result based on the changing characteristics of the historical interaction operations in the time series over time includes at least one of the following: Identify the overall changes of the time series within the historical period and obtain a trend term as the interaction evaluation result. The trend term is used to indicate the interaction change trend between the at least one first object and the second object. Identify the repetitive changes of the time series between each preset period in the historical time period to obtain a periodic item as the interaction evaluation result. The periodic item is used to indicate the periodic change characteristics of the interaction between the at least one first object and the second object between the preset periods. Identify the changes in the time series during a preset event within the historical period to obtain event items as the interaction evaluation results. The event items are used to indicate the short-term change characteristics of the interaction between the at least one first object and the second object under the influence of the preset event. The fluctuations generated by the time series during the historical period are identified, and an error term is obtained as the interaction evaluation result. The error term is used to indicate the random variation characteristics of the interaction between the at least one first object and the second object.

4. The method according to claim 2, characterized in that, The determination of the interaction evaluation result based on the changing characteristics of the historical interaction operations in the time series over time includes: Based on the characteristics of the historical interaction operations in the time series over time, intermediate prediction values ​​are obtained. The intermediate prediction values ​​include time period evaluation values ​​corresponding to at least two sub-time periods in the historical time period. The time period evaluation values ​​are used to evaluate the maintenance of the interaction between at least one first object and the second object in the sub-time period. Obtain weight data, which is used to indicate the weight of the time period evaluation value corresponding to the at least two sub-time periods respectively; The interaction evaluation result is obtained by weighting and summing the time period evaluation values ​​of the at least two sub-time periods based on the weighted data.

5. The method according to claim 4, characterized in that, The acquisition of weight data includes: Obtain platform lifecycle data and object satisfaction data for the application platform to which the first object belongs in at least two sub-time periods, respectively. The platform lifecycle data is used to indicate the lifecycle stage of the application platform in the sub-time period, and the object satisfaction data is used to indicate the user satisfaction of the first object with the second object in the sub-time period. The weight data is obtained by determining the weights corresponding to the at least two sub-time periods based on the platform lifecycle data and the object satisfaction data.

6. The method according to any one of claims 2 to 5, characterized in that, The step of serializing the target object data in chronological order to obtain a time series includes: Obtain object information data corresponding to the at least one first object. The object information data includes at least one of the following: basic information of the first object, platform interaction information, and object activity information. The basic information is used to indicate the basic attributes of the first object. The platform interaction information is used to indicate the interaction operations of the first object in the application platform during the historical period. The application platform is the platform to which the first object and the second object belong. The object activity information is the frequency change of the first object logging into the application platform during the historical period. The object information data and the target object data are integrated in the time sequence, and the integration result is serialized to obtain the time series.

7. The method according to any one of claims 1 to 5, characterized in that, The interaction assessment results are used to indicate the magnitude of the predicted change in the interruption of interaction between the at least one first object and the second object during the historical period. When the interaction evaluation result indicates an interaction anomaly between at least one first object and the second object, the method of determining the cause of the interaction anomaly based on the target object data from at least one interaction operation dimension to obtain an anomaly identification result includes: If the magnitude of change indicated by the interaction evaluation result reaches a preset magnitude threshold, the cause of the interaction anomaly is determined from the at least one interaction operation dimension based on the target object data, and the anomaly identification result is obtained.

8. The method according to any one of claims 1 to 5, characterized in that, The target object data includes data from at least two interactive operation dimensions, and the interaction evaluation result includes the time period evaluation values ​​corresponding to at least two sub-time periods within the historical time period. When the interaction evaluation result indicates an interaction anomaly between at least one first object and the second object, the method of determining the cause of the interaction anomaly based on the target object data from at least one interaction operation dimension to obtain an anomaly identification result includes: If the interaction assessment result indicates an abnormal interaction between the at least one first object and the second object, at least one abnormal sub-period shall be determined from the at least two sub-periods based on the interaction assessment result; Based on the time period evaluation value corresponding to the at least one abnormal sub-time period, the attribution analysis data corresponding to the at least two interactive operation dimensions are determined respectively, and the attribution analysis data is used to indicate the score of the interactive operation dimension under the preset analysis index. Attribution dimensions are determined from the at least two interaction operation dimensions based on the attribution analysis data corresponding to each of the at least two interaction operation dimensions, and are used as the anomaly identification results.

9. The method according to claim 8, characterized in that, The time period assessment value is used to indicate the magnitude of the predicted change in the interruption of interaction between the at least one first object and the second object within the corresponding sub-time period; The determination of attribution analysis data corresponding to the at least two interaction operation dimensions based on the time period evaluation value corresponding to the at least one abnormal sub-time period includes: Obtain the abnormal true value corresponding to the at least one abnormal sub-period, the abnormal true value being used to indicate the actual change in the magnitude of the interruption of interaction between the at least one first object and the second object within the abnormal sub-period; Based on the time period evaluation value corresponding to the at least one abnormal sub-time period, the dimension evaluation value corresponding to the at least two interaction operation dimensions is determined respectively. The dimension evaluation value is used to indicate the magnitude of the predicted change in the interaction interruption between the at least one first object and the second object under the interaction operation dimension within the abnormal sub-time period. Based on the difference between the dimensional evaluation value and the abnormal true value, a first attribution value is determined for each of the at least one abnormal sub-period. Based on the proportion of the dimension evaluation value in the time period evaluation value, determine the second attribution value corresponding to each of the at least one abnormal sub-time period; The first attribution value and the second attribution value are used as the attribution analysis data.

10. The method according to claim 9, characterized in that, The step of determining the attribution dimension from the at least two interaction operation dimensions based on the attribution analysis data corresponding to each of the at least two interaction operation dimensions, as the anomaly identification result, includes: The interaction dimension in which the first attribution value is greater than the first threshold and the second attribution threshold is less than or equal to the second threshold is determined as the attribution dimension, and the anomaly identification result is obtained.

11. An anomaly detection device, characterized in that, The device includes: The acquisition module is used to acquire target object data of at least one first object, wherein the first object is an object that has interacted with a second object during a historical period, and the target object data is used to indicate the historical interaction operations between the first object and the second object during the historical period, wherein the object types of the first object and the second object are different. The first identification module is used to determine the interaction evaluation result corresponding to the at least one first object based on the change characteristics of the target object data over time. The interaction evaluation result is used to indicate the interaction maintenance status between the at least one first object and the second object. The second identification module is used to determine the cause of the interaction anomaly based on the target object data from at least one interaction operation dimension when the interaction evaluation result indicates an interaction anomaly between the at least one first object and the second object, and obtain an anomaly identification result, wherein the anomaly identification result is used to indicate the factors that caused the interaction anomaly.

12. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one program, which is loaded and executed by the processor to implement the anomaly identification method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the anomaly identification method as described in any one of claims 1 to 10.

14. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the anomaly identification method as described in any one of claims 1 to 10.

Images